Privacy Policy
Salmamail is built to store as little as possible. This page explains exactly what is stored, what is never kept, how long things live, and what happens on the ad-supported content pages.
What we store
- Mailbox address and an access token (a credential scoped to one mailbox).
- Password stored only as a PBKDF2-SHA256 hash (100k iterations) — never in plain text.
- Messages you receive: sender, subject, body, attachments — kept so you can read them.
- Optional recovery email, if you set one.
What we never keep
- No raw IP addresses anywhere — audit entries store only salted SHA-256 hashes (90 days).
- No passwords, tokens, OTP codes or QR codes in logs, analytics or admin views.
- No third-party tracking or advertising inside your inbox, and no selling of mailbox contents.
- By default, administrators work with mailbox metadata only (status, counts, sizes).
Cookies and local storage
Inside the Salmamail app there are no tracking cookies. Your browser keeps a small local record so it can remember which mailboxes are yours — that record stays in your browser and is removed when you clear browser data or delete a mailbox.
Advertising on content pages
Pages like the blog, guides and FAQ are supported by advertising. When ads are enabled, they are provided by Google AdSense. Google and its partners may use cookies or similar technologies to serve ads based on your prior visits to this and other websites. This never applies to your inbox — no ad code runs in the app itself.
- You can opt out of personalized advertising in Google Ads Settings.
- More detail: How Google uses cookies in advertising.
- Visitors in the EEA, UK and Switzerland are asked for consent through a Google-certified consent message before personalized ads are served.
Abuse & legal access
To investigate abuse (spam, phishing, fraud) or comply with lawful requests, the operator can open a mailbox and read its messages from the admin console. This is not routine: each mailbox open, message read and attachment download is recorded in the audit trail with a timestamp, and access is limited to abuse and legal cases. Passwords, access tokens and QR codes are never shown to administrators.
Retention
- Mail stays until you delete it; trashed mail is auto-purged after 30 days.
- Pairing codes expire (~10 minutes) and are purged 7 days after expiry.
- Audit entries (hashed IPs, action names) are purged after 90 days.
- Deleting your mailbox removes its messages. Forgotten mailboxes are cleaned automatically.
Remote images
Images inside emails are blocked by default because opening them can reveal to the sender that you read the mail, along with metadata like your IP address. You can load them per message with the image button.
Data location
Everything runs on Cloudflare (Workers, D1, R2) — data is stored on Cloudflare's global infrastructure.
Your choices
- Delete a mailbox at any time from the app — its messages go with it.
- There is no account to close: nothing links your identity to your mailboxes.
- For any privacy question or request, contact us.
Changes to this policy
If this policy changes, the date at the top of this page changes with it. Significant changes will also be noted in the app where practical.
Contact
Privacy questions: write to [email protected].